Another mainstream direction to preserve the privacy of the inference is the differential privacy [1]}, which consists of adding noise to the input data in order to obscure it. A similar technique to secure the inference process is the encryption, which is introduced in [2]} and [3]}. This approach proposes to infer encoded data, in order to guarantee the non-leakage of the private information. The main drawbacks of the two aforementioned techniques are the potential accuracy loss, the computation overhead, and the incompatibility of these tasks with some DNN operations [4]}.
Finally, many efforts focused on building a Trusted Execution Environment (TEE) on-device to run the DNN inference privately. This approach consists of establishing an isolated region implemented in the main processor, in order to ensure the confidentiality of the data and the model. In this way, untrusted devices cannot access the TEE content. However, this requires special architecture support on the device, and careful crypto key management, which may not be adequate to all IoT data-generating devices.
Moreover, the TEE approach incurs a computation overhead and a potential accuracy loss, as shown in [5]} and [6]}.
